Introduction
In April 2018, the Reserve Bank of India issued a landmark circular mandating that all payment system data generated from transactions in India must be stored exclusively within the country. This directive, often referred to as the RBI data localization mandate, sent ripples through the banking and fintech ecosystem. Global payment networks, digital wallets, card processors, and fintech startups were given six months to comply - a timeline many found impossibly tight. Years later, the mandate remains one of the most significant regulatory requirements for any entity processing payment data in India. With the DPDPA now adding a broader data protection layer on top, understanding and complying with RBI's data localization requirements has become even more critical. This guide walks through the mandate's scope, covered entities, technical requirements, and practical compliance strategies.
What the RBI Mandate Requires
The RBI circular on Storage of Payment System Data dated April 6, 2018, requires that the entire payment data - including full end-to-end transaction details, information collected, carried, and processed as part of the payment message or instruction - must be stored in systems located only in India. This is not limited to final transaction records; it encompasses the entire data lifecycle from initiation to completion. The mandate applies to data at rest and requires that even if data is processed abroad during the course of a transaction, a copy must be deleted from foreign servers and the original must reside in India. The RBI clarified in subsequent FAQs that the requirement covers all data elements such as customer data, payment-sensitive data, payment credentials, and transaction data. Foreign legs of transactions can be stored abroad, but the domestic component must remain within Indian borders. This totality of scope is what makes the mandate particularly challenging for organizations with global infrastructure.
Which Entities Are Covered
The data localization mandate applies broadly to all entities that are part of the payment ecosystem in India. Understanding whether your organization falls within scope is the first step toward compliance.
- Payment system operators authorized by RBI under the Payment and Settlement Systems Act, 2007 - including card networks, mobile wallet operators, and UPI service providers
- Banks operating in India - all scheduled commercial banks, cooperative banks, and regional rural banks that process payment transactions
- Payment aggregators and payment gateways that facilitate merchant payments and collect transaction data in the process
- Card networks such as Visa, Mastercard, and RuPay that process transactions involving Indian cardholders
- Fintech companies operating prepaid payment instruments (PPIs), including mobile wallets and prepaid cards
- Third-party application providers (TPAPs) on the UPI platform that handle or store payment-related data
What Data Must Stay in India
The RBI mandate covers a comprehensive set of data elements that must be stored domestically. The scope is intentionally broad to prevent circumvention through narrow data categorization. Full end-to-end transaction details must reside in India, which includes customer name, mobile number, email address, Aadhaar number, PAN number, and any other information collected during the payment process. Payment-sensitive data such as customer and beneficiary account details, payment credentials including OTPs and PINs, and transaction metadata like timestamps, amounts, and reference numbers are all in scope. Even derived data and analytics generated from payment transactions fall under the mandate. The RBI has been clear that the spirit of the regulation is to ensure that Indian payment data cannot be accessed, processed, or analysed from servers outside India without appropriate oversight. Organizations that attempt to store only partial data domestically while keeping enriched datasets abroad are not in compliance.
Technical Architecture for Compliance
Building a data localization-compliant architecture requires thoughtful planning, particularly for organizations with existing global infrastructure. The challenge is not merely storing a copy of data in India - it is ensuring that the primary and sole storage of covered data is within Indian borders while maintaining system performance and reliability.
- Deploy primary databases for payment data in Indian data centres with appropriate redundancy across multiple availability zones within the country
- Implement data segregation at the application layer to separate payment data from non-payment data, allowing non-covered data to flow freely if needed
- Use Indian cloud regions from providers like AWS Mumbai, Azure Central India, or Google Cloud Mumbai for all payment data processing and storage
- Build data purging mechanisms to automatically delete payment data from foreign servers after processing is complete, with audit trails proving deletion
- Implement encryption at rest and in transit with encryption keys managed within India - key management is often overlooked but is essential for true localization
- Design disaster recovery and backup systems that replicate within India rather than to foreign regions
Compliance Steps for Banks and Fintechs
Achieving compliance with the RBI data localization mandate involves a structured, multi-phase approach. Organizations should begin with a comprehensive data flow mapping exercise to understand exactly where payment data is generated, transmitted, processed, and stored. This mapping should cover all systems, including legacy infrastructure that may not be on the compliance team's radar. Next, conduct a gap analysis to identify all instances where payment data leaves Indian borders - including cloud storage, third-party integrations, analytics platforms, and backup systems. Once gaps are identified, develop a remediation plan that prioritizes the highest-risk data flows. Work with cloud providers and infrastructure teams to migrate data storage and processing to Indian regions. Update data processing agreements with all vendors and third-party processors to include explicit data localization commitments. Finally, establish ongoing monitoring and audit mechanisms to ensure continued compliance as systems evolve and new integrations are added.
Penalties and Enforcement
The RBI has demonstrated its willingness to enforce the data localization mandate through concrete actions. While the Payment and Settlement Systems Act does not specify exact penalty amounts for data localization violations, the RBI retains broad powers to impose directions, restrict operations, or revoke authorizations for non-compliant entities. In practice, the RBI has conducted on-site inspections and audits of payment system operators to verify compliance. Entities that have failed to demonstrate full compliance have faced regulatory scrutiny, including show-cause notices and requirements to submit detailed compliance reports with board-level attestation. For foreign payment networks, the RBI has also linked compliance with the data localization mandate to the approval of new business lines and products in India. Non-compliance effectively becomes a barrier to growth. Beyond direct regulatory penalties, non-compliance creates significant reputational risk, as any enforcement action becomes public and can erode trust among partners and customers.
Interaction with DPDPA and Other Regulations
The RBI data localization mandate does not exist in isolation. It intersects with several other regulatory frameworks that organizations must navigate simultaneously. The DPDPA's cross-border data transfer provisions under Section 16 operate alongside the RBI mandate - payment data that must be localized under the RBI circular cannot be transferred abroad even if the DPDPA's negative list permits transfers to that country. The DPDPA adds obligations around consent, data principal rights, and breach notification that apply to the same payment data covered by the RBI mandate. Additionally, SEBI's cybersecurity and data handling guidelines, IRDAI's data regulations for insurance-linked payment products, and the IT Act's existing requirements all create a layered compliance landscape. Organizations need a unified compliance strategy that addresses all these overlapping requirements rather than treating each regulation as a separate project.
How Kraver.ai Helps with Data Localization Compliance
Kraver.ai's platform provides automated data flow mapping that identifies every instance of payment data across your infrastructure - including cloud services, third-party integrations, and legacy systems. Our AI engine continuously monitors data movement to detect any payment data leaving Indian borders and alerts compliance teams in real-time. The platform generates comprehensive audit reports that demonstrate localization compliance to RBI auditors, including data residency verification, deletion certification for foreign copies, and encryption key management documentation. By integrating RBI data localization requirements with DPDPA compliance within a single platform, Kraver.ai eliminates the silos and duplication that come with managing multiple regulatory frameworks separately.